99e1245ed3
- CI: replace GitLab pipeline with Gitea Actions (.gitea/workflows/release.yaml); publish .deb/image/hosted/chart to Gitea registries; gate image+hosted on .deb (needs + registry pre-check) - drop connectone/Nexus; apt now from the Gitea Debian registry - single version source (/VERSION=3.2.8); CI enforces .env/Chart consistency - restructure: build/->packaging/deb, root Dockerfile->packaging/image, hosted/->packaging/hosted, .kube/->charts/freeradius - Helm chart: documented values, DB password via Secret/$ENV, configurable scheduling/persistence; remove plaintext creds and hostPath PV - gitignore *.env_cnf; docs for hosted (RU)/helm/root + agent KB sync Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
88 lines
3.4 KiB
Markdown
88 lines
3.4 KiB
Markdown
# FreeRADIUS
|
|
|
|
Packaging and delivery of a custom FreeRADIUS 3.2.x build for
|
|
hotspot / captive-portal scenarios. There is no application code here — the repo
|
|
builds upstream FreeRADIUS with the extra `rlm_raw` module and ships it to two
|
|
runtimes (bare-metal and Kubernetes) via a Gitea-hosted registry.
|
|
|
|
## Single source of version truth
|
|
|
|
[`VERSION`](VERSION) holds the FreeRADIUS release (`3.2.8`). CI derives everything
|
|
from it: the build tag `release_3_2_8`, the package pin `3.2.8+git`, the chart
|
|
`appVersion`. CI fails if `packaging/hosted/.env` or `charts/freeradius/Chart.yaml`
|
|
drift from `VERSION`.
|
|
|
|
## Layout
|
|
|
|
```
|
|
VERSION single source of the FreeRADIUS version
|
|
.gitea/workflows/release.yaml manual release pipeline (Gitea Actions)
|
|
packaging/
|
|
deb/ build the .deb from FreeRADIUS source + rlm_raw, upload to registry
|
|
image/ runtime container image (installs the .deb, bakes configs)
|
|
hosted/ bare-metal / VM install (install.sh, update.sh, config, cron)
|
|
charts/
|
|
freeradius/ productized Helm chart
|
|
```
|
|
|
|
## Artifacts (Gitea, owner `pub`)
|
|
|
|
| Artifact | Registry |
|
|
|----------|----------|
|
|
| `.deb` packages | `https://git.ahax86.ru/api/packages/pub/debian` (`noble main`) |
|
|
| Container image | `git.ahax86.ru/pub/freeradius:<version>` |
|
|
| Hosted bundle | `.../api/packages/pub/generic/hosted/<version>/hosted.tar.gz` |
|
|
| Helm chart | `https://git.ahax86.ru/api/packages/pub/helm` |
|
|
|
|
## Release flow (`.gitea/workflows/release.yaml`, manual)
|
|
|
|
```
|
|
prepare ──► build-deb ──► build-image ──► package-helm
|
|
└──► package-hosted
|
|
```
|
|
|
|
The `.deb` is the prerequisite: `build-image` and `package-hosted` both `needs:
|
|
build-deb` **and** verify the pinned version exists in the Debian registry
|
|
before running. Trigger from Gitea → Actions → `release` → *Run workflow*.
|
|
|
|
### CI setup (Gitea)
|
|
|
|
1. **Runner.** Enable Actions for the repo and register an `ubuntu-latest` runner
|
|
(`act_runner`) with Docker available. If your runner uses a different label,
|
|
change `runs-on` in the workflow.
|
|
2. **Access token.** Gitea → avatar → *Settings* → *Applications* →
|
|
*Manage Access Tokens* → *Generate New Token*. Scopes: `write:package` and
|
|
`read:package`. Copy the token (shown once).
|
|
3. **Repo secrets.** Repo → *Settings* → *Actions* → *Secrets* → *Add Secret*:
|
|
- `PACKAGES_USER` — your Gitea username (the token owner).
|
|
- `PACKAGES_TOKEN` — the token from step 2.
|
|
|
|
These secrets are used to push to the container / Debian / generic / Helm
|
|
registries and to read the Debian `Packages` index in the gate check.
|
|
|
|
## Local builds (no upload)
|
|
|
|
```bash
|
|
# .deb builder image
|
|
docker build packaging/deb -f packaging/deb/Dockerfile \
|
|
--build-arg RADIUS_TAG=release_3_2_8 --build-arg RLM_RAW_BRANCH=v3.2.4 \
|
|
-t freerad-builder:3.2.8
|
|
|
|
# runtime image (context = repo root; pulls .deb from the Debian registry)
|
|
docker build -f packaging/image/Dockerfile --build-arg PKG_VERSION=3.2.8+git -t freeradius:3.2.8 .
|
|
|
|
# chart
|
|
helm lint charts/freeradius --set db.password=test
|
|
helm template freeradius charts/freeradius --set db.password=test
|
|
```
|
|
|
|
## Deployment docs
|
|
|
|
- Bare-metal / VM: [packaging/hosted/README.md](packaging/hosted/README.md)
|
|
- Kubernetes (Helm): [charts/freeradius/README.md](charts/freeradius/README.md)
|
|
|
|
## Internals
|
|
|
|
See [agent/INDEX.md](agent/INDEX.md) for invariants, hosts/ports, backends and
|
|
known constraints.
|